Why I get Internet Explorer enhanced security error message in Chrome if I call VSO API from Angularjs SPA?

Question

I have a SPA implemented in Angularjs - Typescript calling VSO API and providing authentication data you can find below:

((): void => {
    "use strict";

    angular
        .module("app")
        .config(config);

    config.$inject = [
        "$httpProvider"
    ];

    function config(
        $httpProvider: ng.IHttpProvider
    ) {

        $httpProvider.defaults.headers.common['Authorization'] = "Bearer username:password";

    }
});

I see the Network tab of the browser that this call will be redirected to here:

https://app.vssps.visualstudio.com/_signin?realm=dldxdm.visualstudio.com&reply_to...

And a following request.

The console does not show any authentication error, but there is no result of my request (GET) but it should be! Instead of the result I get the message you can see in the screenshot. It is Microsoft Internet Explorer's Enhanced Security Configuration is currently enabled on your environment. This enhanced level of security prevents our web integration experiences from displaying or performing correctly. To continue with your operation please disable this configuration or contact your administrator. But the query executed in Chrome. Why an IE error message is here?

In the browser I logged in to VSO to the project, and if I copy the url and paste into another tab and execute it I'll get the proper result I'm looking for.

Questions:

why there is no result for my query executed by Angular app?
how should I authenticate for VSO? I cannot set up a token because it runs on localhost currently.

I googled for the IE error message but there is no answer. The how to disable the enhanced security of IE I have found Windows Server answers. I don't think they are related to my issue.

Update:

Ok, I have an article about what is happening. Next step, implementation.

I got that error trying to curl https://$VSTS_ACCOUNT.visualstudio.com/_apis/distributedtask/packages/agent?platform=ubuntu.$UBUNTU_VERSION-x64 from the vsts agent docker container. It's unbelievable that a server side error is assuming you're using IE as your browser. curl is not IE, there are no security zones whatever things on ubuntu. — Aaron McMillin, Feb 01 '17 at 19:34

score 15 · Accepted Answer · answered Feb 02 '17 at 04:03

15

I found that this happened to me when my PAT was wrong due to a copy and paste error.

Looks like you are probably failing authentication because you didn't base64 encode the bearer token.

answered Feb 02 '17 at 04:03

Aaron McMillin

2,532
27
42

10

For us this was because the PAT has to be prefix by ":" before you base 64 encode it. Then supply this as Authorization header: Basic – Andy May 24 '17 at 16:51
@Andy: you can add this as an answer, FYI: it resolved my issue. – Balaji Kuppuswamy Apr 25 '18 at 03:55
@RuSs I've flagged your comment: Suggesting that users use a 3rd party site to encrypt security keys is a dangerous practice. – Aaron McMillin May 28 '18 at 16:01
@Andy thanks. I deleted my answer. I'm an idiot. I was saying the right answer was that the PAT needs to be prefixed with a colon. I tried it yesterday. – RuSs May 28 '18 at 20:53

score 9 · Answer 2 · answered Mar 02 '20 at 14:00

9

I had this same issue. I verified this in postman as follows...

I didn't have to base64 encode my PAT. I found that I just needed to double check that my PAT had the right access. I passed the data as Basic Auth. Username: "whatever the hell you want" Password: PAT

Response: 200

answered Mar 02 '20 at 14:00

ChrisAddams

190
1
8

1

All above answers didnt work for me except this one. Thank you! – Repcak Sep 17 '20 at 11:49

Arun Joseph · Answer 3 · 2020-11-02T15:30:06.597

9

Prefix your Personal Access Token(PAT) with :(colon). then Base 64 encode it.

Eg:

If "myaccesstoken" is my PAT,

Apply base 64 encoder to ":myaccesstoken"

In the Authorization header, place your base encoded string as,

Authorization : Basic MyColonPrefixedBase64String

edited Nov 02 '20 at 15:30

answered Jul 06 '20 at 14:02

Arun Joseph

2,736
25
35

1

You save me after some hours! – apaternina Mar 26 '21 at 12:25

score 0 · Answer 4 · answered Dec 07 '21 at 06:41

If somebody else comes on this page after getting same error in Azure devops classic pipeline (like I did) then they may need to select radio button titled "Allow scripts to access the OAuth token". This option is available here "Stage >> Agent Job >> Additional Options". For more clarity, you may wan to refer this blog post.

Why I get Internet Explorer enhanced security error message in Chrome if I call VSO API from Angularjs SPA?

4 Answers4

Linked